<![CDATA[🔴 Critical: WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers]]>WordPress has patched a critical vulnerability in its core software that could allow an unauthenticated attacker to make a site load a PHP file from outside its theme directories. On certain server configurations, this flaw can be escalated further, enabling an attacker to execute arbitrary code on the affected site.

The fix was released on September 22 in WordPress 7.1.2, and patches were also backported to every branch the project still supports, going all the way back to 4.7. Site owners are being urged to update as soon as possible.

  • Update to WordPress 7.1.2 or the latest patched release for your branch
  • Apply updates to all supported versions back to 4.7
  • Verify your site is running the latest core version after updating

Given the unauthenticated nature of the flaw and the potential for code execution depending on server setup, prioritizing this update is strongly recommended.

Source: The Hacker News

Has your organization already pushed the 7.1.2 update across all WordPress instances, or are you still working through legacy branches?

]]>https://xploitlk.com/topic/434/critical-wordpress-issues-patch-for-critical-flaw-that-can-enable-code-execution-on-some-serversRSS for NodeTue, 27 Oct 2026 11:01:22 GMTWed, 23 Sep 2026 06:30:18 GMT60